Arch Linux Security Advisory ASA-201911-3 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-9169 Package : glibc Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-855 Summary ======= The package glibc before version 2.30-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.30-1. # pacman -Syu "glibc>=2.30-1" The problem has been fixed upstream in version 2.30. Workaround ========== None. Description =========== In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. Impact ====== An attacker is able to use malicious regular expressions to get access to sensitive information. References ========== https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=583dd860d5b... https://sourceware.org/bugzilla/show_bug.cgi?id=24114 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 https://security.archlinux.org/CVE-2019-9169